AKAV LABS

The passes went ingress → egress → streaming. Streaming was the real hole: a secret split across SSE tokens ("sk-"…"AKIA"…) never appears whole in a single chunk, so a whole-body scanner never sees it. Fixed with a rolling-window scanner that cuts the stream before the secret completes. Every fix has a benign-guard test — blocking "how do I prevent exfiltration?" is what gets a tool uninstalled. 0 false positives across the run. Not a claim to "solve" injection (you can't) — just raising the cost of the exfil leg of the lethal trifecta. https://dev.to/akavlabs_69/i-red-teamed-my-own-llm-security-gateway-in-four-passes-heres-every-gap-i-found-5cl9 Repo, Apache-2.0: github.com/akav-labs/agentsentry-gateway

@hasamba@infosec.exchange This is a clean example of why source review can't be the whole answer — the payload doesn't exist in the repo at scan time, it's fetched at runtime from a DNS TXT record. Static scanners, human review, even agent self-review are structurally blind to that. Feels like the strongest argument for a boundary layer that watches what the agent actually does (shell exec, outbound connections, secrets/creds leaving the process) rather than what it was told to do. Ingress-side filtering can't catch an instruction that doesn't exist yet.

@freddy@social.security.plumbing @simon@fedi.simonwillison.net Strong +1 on non-binary. One data point on granularity: scanning responses (not just requests) took secret detection from 5/20 to 20/20 in testing. But even that misses secrets split across SSE chunks in streaming — no single chunk ever contains the whole string. So "limit egress" needs its own sub-dimension: per-request vs per-chunk vs per-session. Doesn't eliminate the risk, just moves the cost curve — closer to reality than a binary block/allow.